Third-party assets missing Subresource Integrity
A cross-origin script or stylesheet in the HTML has no integrity hash.
Why it matters
If that host is compromised, it can change the file and the browser will run or apply the new bytes. The severity is higher when the asset is a script and CSP does not already pin it with a nonce or hash.
What to do
Add integrity and crossorigin on those tags, or host the files on your own origin.
Reference
Integrity hashes keep third-party scripts and styles from executing if the CDN is tampered with.